Congress of tfje United states 

iHasIjmgton, M 20515 


June 13,2019 


The Honorable Kevin McAleenan 
Acting Secretary of Homeland Security 
United States Department of Homeland Security 
300 7th Street, S.W. 

Washington, D.C. 20024 


Dear Secretary McAleenan: 

We write to express concerns about reports that the U.S. Customs and Border Protection (CBP) 
is using facial recognition technology to scan American citizens under the Biometric Exit 
Program. This is an unprecedented and unauthorized expansion of the agency’s authority. As 
such, we urge the agency to allow for public input and establish privacy safeguards. 

The Department of Homeland Security’s 2016 “Entry/Exit Overstay Report” states that “the 
entry/exit mission is to successfully capture and match the arrival and departure records of 
foreign nationals who visit the United States to help determine who is lawfully abiding by, or 
violating, immigration law.” [1] Under current law, CBP is permitted to obtain biographic and 
biometric information of foreign nationals through the Biometric Exit Program. In 2018, CBP 
expanded this pilot program to include facial recognition scans on individuals boarding certain 
international flights. 

Considering that the legal authority which CBP cites to carry out this program expressly limits 
the collection of biometric data to “foreign nationals,” we were stunned to learn of reports that 
the agency has partnered with the Transportation Security Administration and commercial 
airlines to use facial recognition technology on American citizens. It remains unclear under what 
authority CBP is carrying out this program on Americans. 

Among the strong concerns that travelers have expressed about this program is the inadequate 
notice and information that is currently provided to Americans. On the CBP Biometic Exit FAQs 
website, it states that “CBP does not require U.S. Citizens or exempt aliens to have their photos 
taken. U.S. Citizens and exempt aliens who do not wish to participate in this biometric collection 
should notify a CBP Officer or an airline or airport representative in order to seek an alternative 
means of verifying their identity and documents”^ This guidance comes too little, too late for 
most travelers. The random nature of this pilot program does not allow travelers the requisite 
advanced notice to make an informed decision on their willingness to participate. 


F ihttps://www.dhs.gov/sites/default/files/publications/FY%2015%20DHS%20Entrv%20and%20Exit%200verstav% 

20Report.pdf 

PI https://www.cbp.gov/travePbiometrics/biometric-exit-faQS 
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Americans are also troubled about the potential misuse and accuracy of data captured in this 
facial recognition program, of which they have little control. False matches and algorithmic bias 
problems in facial recognition technology are well-documented. A September 2018 DHS 
Inspector General report noted a “low 85-percent biometric confirmation rate ” [3] The same 
report stated that U.S. citizens accounted for the lowest biometric confirmation rate and were up 
to six times more likely to be rejected than non-U.S. citizens. The report identified that 
passengers under age 29 or over 70 had lower match rates than other passengers. [4] Moreover, 
CBP claims that the success of this program will rely upon airports and airlines purchasing 
digital cameras. CBP has provided limited guidance on how it would prevent the potential 
misuse of data by private companies. 

Serious issues with the Biometric Exit Program have gone unaddressed. As federal 
representatives, we believe the American people deserve transparency regarding how their 
biometric data is being used and stored. We urge you to clearly identify: 

1) What laws/statutes give CBP the authority to use facial recognition technology on American 
citizens in the DHS exit program? 


2) What effort has CBP made to provide adequate advanced notice about this program and op- 
out procedures to travelers? 

3) What is the nature of the contracts between CBP, airports and airlines? What legal liability do 
airport and airlines share under this program? 

4) CBP recently acknowledged that one agency subcontractor had “violated mandatory security 
and privacy protocols outlined in their contract” and transferred copies of license plate images 
and traveler images to the company network. The subcontractor’s network was then 
compromised by a cyberattack. How many audits has CBP conducted to date on CBP’s approved 
partners to ensure they are immediately purging photos following transmittal to the Traveler 
Verification Service (TVS) and what were the findings from the audits? 


Given the continued false matches and algorithmic bias problems in facial recognition 
technology and the use of this technology on U.S. citizens, we call on the Department of 
Homeland Security to allow for public input and address transparency, privacy and security 
concerns before expanding this program. 



131 Progress Made, but CBP Faces Challenges Implementing a Biometric Capability to Track Air Passenger 
Departures Nationwide, September 21,2018 https://www.oig.dhs.gov/sites/default/files/assets/2018-09/01G-18-8Q- 
Sepl8.pdf 

W Ibid. 
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